[PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite

All of lore.kernel.org
 help / color / mirror / Atom feed

* [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite
@ 2016-10-20 10:26 Davide Caratti
  2016-10-20 10:26 ` [PATCH nf-next 1/3] netfilter: built-in NAT support for DCCP Davide Caratti
                   ` (3 more replies)
  0 siblings, 4 replies; 8+ messages in thread
From: Davide Caratti @ 2016-10-20 10:26 UTC (permalink / raw)
  To: Pablo Neira Ayuso, Patrick McHardy, Jozsef Kadlecsik,
	David S. Miller, Arturo Borrero Gonzalez, Florian Westphal
  Cc: netfilter-devel, coreteam

The above L4 protocols usually need an explicit modprobe command (e.g
"modprobe nf_nat_proto_sctp") to provide full functionality of REDIRECT
targets and SNAT/DNAT targets where port number translation is explicitly
configured.
In order to remove such limitation, this series converts 
CONFIG_NF_NAT_PROTO_{DCCP,SCTP,UDPLITE} from tristate to boolean: in case 
NAT support for these protocols is enabled in the kernel configuration, it
will be built into nf_nat.ko.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>

Davide Caratti (3):
  netfilter: built-in NAT support for DCCP
  netfilter: built-in NAT support for SCTP
  netfilter: built-in NAT support for UDPlite

 include/net/netfilter/nf_nat_l4proto.h |  9 +++++++++
 net/netfilter/Kconfig                  |  6 +++---
 net/netfilter/Makefile                 | 10 +++++-----
 net/netfilter/nf_nat_core.c            | 12 ++++++++++++
 net/netfilter/nf_nat_proto_dccp.c      | 36 +---------------------------------
 net/netfilter/nf_nat_proto_sctp.c      | 35 +--------------------------------
 net/netfilter/nf_nat_proto_udplite.c   | 35 +--------------------------------
 7 files changed, 32 insertions(+), 111 deletions(-)

-- 
2.5.5


^ permalink raw reply	[flat|nested] 8+ messages in thread

* [PATCH nf-next 1/3] netfilter: built-in NAT support for DCCP
  2016-10-20 10:26 [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite Davide Caratti
@ 2016-10-20 10:26 ` Davide Caratti
  2016-10-20 12:37   ` Pablo Neira Ayuso
  2016-10-20 10:26 ` [PATCH nf-next 2/3] netfilter: built-in NAT support for SCTP Davide Caratti
                   ` (2 subsequent siblings)
  3 siblings, 1 reply; 8+ messages in thread
From: Davide Caratti @ 2016-10-20 10:26 UTC (permalink / raw)
  To: Pablo Neira Ayuso, Patrick McHardy, Jozsef Kadlecsik,
	David S. Miller, Arturo Borrero Gonzalez, Florian Westphal
  Cc: netfilter-devel, coreteam

CONFIG_NF_NAT_PROTO_DCCP is no more a tristate. When set to y, NAT
support for DCCP protocol is built-in into nf_nat.ko.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
---
 include/net/netfilter/nf_nat_l4proto.h |  3 +++
 net/netfilter/Kconfig                  |  2 +-
 net/netfilter/Makefile                 |  3 ++-
 net/netfilter/nf_nat_core.c            |  4 ++++
 net/netfilter/nf_nat_proto_dccp.c      | 36 +---------------------------------
 5 files changed, 11 insertions(+), 37 deletions(-)

diff --git a/include/net/netfilter/nf_nat_l4proto.h b/include/net/netfilter/nf_nat_l4proto.h
index 12f4cc8..6328c18 100644
--- a/include/net/netfilter/nf_nat_l4proto.h
+++ b/include/net/netfilter/nf_nat_l4proto.h
@@ -54,6 +54,9 @@ extern const struct nf_nat_l4proto nf_nat_l4proto_udp;
 extern const struct nf_nat_l4proto nf_nat_l4proto_icmp;
 extern const struct nf_nat_l4proto nf_nat_l4proto_icmpv6;
 extern const struct nf_nat_l4proto nf_nat_l4proto_unknown;
+#if IS_ENABLED(CONFIG_NF_NAT_PROTO_DCCP)
+extern const struct nf_nat_l4proto nf_nat_l4proto_dccp;
+#endif
 
 bool nf_nat_l4proto_in_range(const struct nf_conntrack_tuple *tuple,
 			     enum nf_nat_manip_type maniptype,
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index e8d56d9..6813126 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -380,7 +380,7 @@ config NF_NAT_NEEDED
 	default y
 
 config NF_NAT_PROTO_DCCP
-	tristate
+	bool
 	depends on NF_NAT && NF_CT_PROTO_DCCP
 	default NF_NAT && NF_CT_PROTO_DCCP
 
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index c23c3c8..ed4cdd6 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -45,6 +45,8 @@ obj-$(CONFIG_NF_CONNTRACK_TFTP) += nf_conntrack_tftp.o
 nf_nat-y	:= nf_nat_core.o nf_nat_proto_unknown.o nf_nat_proto_common.o \
 		   nf_nat_proto_udp.o nf_nat_proto_tcp.o nf_nat_helper.o
 
+nf_nat-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o
+
 # generic transport layer logging
 obj-$(CONFIG_NF_LOG_COMMON) += nf_log_common.o
 
@@ -52,7 +54,6 @@ obj-$(CONFIG_NF_NAT) += nf_nat.o
 obj-$(CONFIG_NF_NAT_REDIRECT) += nf_nat_redirect.o
 
 # NAT protocols (nf_nat)
-obj-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o
 obj-$(CONFIG_NF_NAT_PROTO_UDPLITE) += nf_nat_proto_udplite.o
 obj-$(CONFIG_NF_NAT_PROTO_SCTP) += nf_nat_proto_sctp.o
 
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index bbb8f3d..7cca9f1 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -671,6 +671,10 @@ int nf_nat_l3proto_register(const struct nf_nat_l3proto *l3proto)
 			 &nf_nat_l4proto_tcp);
 	RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_UDP],
 			 &nf_nat_l4proto_udp);
+#if IS_ENABLED(CONFIG_NF_NAT_PROTO_DCCP)
+	RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_DCCP],
+			 &nf_nat_l4proto_dccp);
+#endif
 	mutex_unlock(&nf_nat_proto_mutex);
 
 	RCU_INIT_POINTER(nf_nat_l3protos[l3proto->l3proto], l3proto);
diff --git a/net/netfilter/nf_nat_proto_dccp.c b/net/netfilter/nf_nat_proto_dccp.c
index 15c47b2..269fcd5 100644
--- a/net/netfilter/nf_nat_proto_dccp.c
+++ b/net/netfilter/nf_nat_proto_dccp.c
@@ -10,8 +10,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/dccp.h>
 
@@ -73,7 +71,7 @@ dccp_manip_pkt(struct sk_buff *skb,
 	return true;
 }
 
-static const struct nf_nat_l4proto nf_nat_l4proto_dccp = {
+const struct nf_nat_l4proto nf_nat_l4proto_dccp = {
 	.l4proto		= IPPROTO_DCCP,
 	.manip_pkt		= dccp_manip_pkt,
 	.in_range		= nf_nat_l4proto_in_range,
@@ -82,35 +80,3 @@ static const struct nf_nat_l4proto nf_nat_l4proto_dccp = {
 	.nlattr_to_range	= nf_nat_l4proto_nlattr_to_range,
 #endif
 };
-
-static int __init nf_nat_proto_dccp_init(void)
-{
-	int err;
-
-	err = nf_nat_l4proto_register(NFPROTO_IPV4, &nf_nat_l4proto_dccp);
-	if (err < 0)
-		goto err1;
-	err = nf_nat_l4proto_register(NFPROTO_IPV6, &nf_nat_l4proto_dccp);
-	if (err < 0)
-		goto err2;
-	return 0;
-
-err2:
-	nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_dccp);
-err1:
-	return err;
-}
-
-static void __exit nf_nat_proto_dccp_fini(void)
-{
-	nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_dccp);
-	nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_dccp);
-
-}
-
-module_init(nf_nat_proto_dccp_init);
-module_exit(nf_nat_proto_dccp_fini);
-
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_DESCRIPTION("DCCP NAT protocol helper");
-MODULE_LICENSE("GPL");
-- 
2.5.5


^ permalink raw reply related	[flat|nested] 8+ messages in thread

* Re: [PATCH nf-next 1/3] netfilter: built-in NAT support for DCCP
  2016-10-20 10:26 ` [PATCH nf-next 1/3] netfilter: built-in NAT support for DCCP Davide Caratti
@ 2016-10-20 12:37   ` Pablo Neira Ayuso
  2016-10-20 16:30     ` Davide Caratti
  0 siblings, 1 reply; 8+ messages in thread
From: Pablo Neira Ayuso @ 2016-10-20 12:37 UTC (permalink / raw)
  To: Davide Caratti
  Cc: Patrick McHardy, Jozsef Kadlecsik, David S. Miller,
	Arturo Borrero Gonzalez, Florian Westphal, netfilter-devel,
	coreteam

On Thu, Oct 20, 2016 at 12:26:23PM +0200, Davide Caratti wrote:
> CONFIG_NF_NAT_PROTO_DCCP is no more a tristate. When set to y, NAT
> support for DCCP protocol is built-in into nf_nat.ko.
> 
> Signed-off-by: Davide Caratti <dcaratti@redhat.com>
> ---
>  include/net/netfilter/nf_nat_l4proto.h |  3 +++
>  net/netfilter/Kconfig                  |  2 +-
>  net/netfilter/Makefile                 |  3 ++-
>  net/netfilter/nf_nat_core.c            |  4 ++++
>  net/netfilter/nf_nat_proto_dccp.c      | 36 +---------------------------------
>  5 files changed, 11 insertions(+), 37 deletions(-)
> 
> diff --git a/include/net/netfilter/nf_nat_l4proto.h b/include/net/netfilter/nf_nat_l4proto.h
> index 12f4cc8..6328c18 100644
> --- a/include/net/netfilter/nf_nat_l4proto.h
> +++ b/include/net/netfilter/nf_nat_l4proto.h
> @@ -54,6 +54,9 @@ extern const struct nf_nat_l4proto nf_nat_l4proto_udp;
>  extern const struct nf_nat_l4proto nf_nat_l4proto_icmp;
>  extern const struct nf_nat_l4proto nf_nat_l4proto_icmpv6;
>  extern const struct nf_nat_l4proto nf_nat_l4proto_unknown;
> +#if IS_ENABLED(CONFIG_NF_NAT_PROTO_DCCP)

I think you can replace this by:

#ifdef CONFIG_NF_NAT_PROTO_DCCP

given that IS_ENABLED catches the module case too.

This is is just a code readability nitpick, so whoever reads this code
understands that we have no module support for this anymore.

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH nf-next 1/3] netfilter: built-in NAT support for DCCP
  2016-10-20 12:37   ` Pablo Neira Ayuso
@ 2016-10-20 16:30     ` Davide Caratti
  0 siblings, 0 replies; 8+ messages in thread
From: Davide Caratti @ 2016-10-20 16:30 UTC (permalink / raw)
  To: Pablo Neira Ayuso
  Cc: Patrick McHardy, Jozsef Kadlecsik, David S. Miller,
	Arturo Borrero Gonzalez, Florian Westphal, netfilter-devel,
	coreteam

On Thu, 2016-10-20 at 14:37 +0200, Pablo Neira Ayuso wrote:
> I think you can replace this by:
> 
> #ifdef CONFIG_NF_NAT_PROTO_DCCP
> 
> given that IS_ENABLED catches the module case too.

That's right, so all IS_ENABLED(...) are going to be replaced with #ifdef
... in v2.

regards,
--
davide


^ permalink raw reply	[flat|nested] 8+ messages in thread

* [PATCH nf-next 2/3] netfilter: built-in NAT support for SCTP
  2016-10-20 10:26 [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite Davide Caratti
  2016-10-20 10:26 ` [PATCH nf-next 1/3] netfilter: built-in NAT support for DCCP Davide Caratti
@ 2016-10-20 10:26 ` Davide Caratti
  2016-10-20 10:26 ` [PATCH nf-next 3/3] netfilter: built-in NAT support for UDPlite Davide Caratti
  2016-10-20 10:28 ` [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite Florian Westphal
  3 siblings, 0 replies; 8+ messages in thread
From: Davide Caratti @ 2016-10-20 10:26 UTC (permalink / raw)
  To: Pablo Neira Ayuso, Patrick McHardy, Jozsef Kadlecsik,
	David S. Miller, Arturo Borrero Gonzalez, Florian Westphal
  Cc: netfilter-devel, coreteam

CONFIG_NF_NAT_PROTO_SCTP is no more a tristate. When set to y, NAT
support for SCTP protocol is built-in into nf_nat.ko.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
---
 include/net/netfilter/nf_nat_l4proto.h |  3 +++
 net/netfilter/Kconfig                  |  2 +-
 net/netfilter/Makefile                 |  2 +-
 net/netfilter/nf_nat_core.c            |  4 ++++
 net/netfilter/nf_nat_proto_sctp.c      | 35 +---------------------------------
 5 files changed, 10 insertions(+), 36 deletions(-)

diff --git a/include/net/netfilter/nf_nat_l4proto.h b/include/net/netfilter/nf_nat_l4proto.h
index 6328c18..d3d1670 100644
--- a/include/net/netfilter/nf_nat_l4proto.h
+++ b/include/net/netfilter/nf_nat_l4proto.h
@@ -57,6 +57,9 @@ extern const struct nf_nat_l4proto nf_nat_l4proto_unknown;
 #if IS_ENABLED(CONFIG_NF_NAT_PROTO_DCCP)
 extern const struct nf_nat_l4proto nf_nat_l4proto_dccp;
 #endif
+#if IS_ENABLED(CONFIG_NF_NAT_PROTO_SCTP)
+extern const struct nf_nat_l4proto nf_nat_l4proto_sctp;
+#endif
 
 bool nf_nat_l4proto_in_range(const struct nf_conntrack_tuple *tuple,
 			     enum nf_nat_manip_type maniptype,
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 6813126..7fa6245 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -390,7 +390,7 @@ config NF_NAT_PROTO_UDPLITE
 	default NF_NAT && NF_CT_PROTO_UDPLITE
 
 config NF_NAT_PROTO_SCTP
-	tristate
+	bool
 	default NF_NAT && NF_CT_PROTO_SCTP
 	depends on NF_NAT && NF_CT_PROTO_SCTP
 	select LIBCRC32C
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index ed4cdd6..8605054 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -46,6 +46,7 @@ nf_nat-y	:= nf_nat_core.o nf_nat_proto_unknown.o nf_nat_proto_common.o \
 		   nf_nat_proto_udp.o nf_nat_proto_tcp.o nf_nat_helper.o
 
 nf_nat-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o
+nf_nat-$(CONFIG_NF_NAT_PROTO_SCTP) += nf_nat_proto_sctp.o
 
 # generic transport layer logging
 obj-$(CONFIG_NF_LOG_COMMON) += nf_log_common.o
@@ -55,7 +56,6 @@ obj-$(CONFIG_NF_NAT_REDIRECT) += nf_nat_redirect.o
 
 # NAT protocols (nf_nat)
 obj-$(CONFIG_NF_NAT_PROTO_UDPLITE) += nf_nat_proto_udplite.o
-obj-$(CONFIG_NF_NAT_PROTO_SCTP) += nf_nat_proto_sctp.o
 
 # NAT helpers
 obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 7cca9f1..f5ee6b5 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -675,6 +675,10 @@ int nf_nat_l3proto_register(const struct nf_nat_l3proto *l3proto)
 	RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_DCCP],
 			 &nf_nat_l4proto_dccp);
 #endif
+#if IS_ENABLED(CONFIG_NF_NAT_PROTO_SCTP)
+	RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_SCTP],
+			 &nf_nat_l4proto_sctp);
+#endif
 	mutex_unlock(&nf_nat_proto_mutex);
 
 	RCU_INIT_POINTER(nf_nat_l3protos[l3proto->l3proto], l3proto);
diff --git a/net/netfilter/nf_nat_proto_sctp.c b/net/netfilter/nf_nat_proto_sctp.c
index cbc7ade..2e14108 100644
--- a/net/netfilter/nf_nat_proto_sctp.c
+++ b/net/netfilter/nf_nat_proto_sctp.c
@@ -7,9 +7,7 @@
  */
 
 #include <linux/types.h>
-#include <linux/init.h>
 #include <linux/sctp.h>
-#include <linux/module.h>
 #include <net/sctp/checksum.h>
 
 #include <net/netfilter/nf_nat_l4proto.h>
@@ -54,7 +52,7 @@ sctp_manip_pkt(struct sk_buff *skb,
 	return true;
 }
 
-static const struct nf_nat_l4proto nf_nat_l4proto_sctp = {
+const struct nf_nat_l4proto nf_nat_l4proto_sctp = {
 	.l4proto		= IPPROTO_SCTP,
 	.manip_pkt		= sctp_manip_pkt,
 	.in_range		= nf_nat_l4proto_in_range,
@@ -63,34 +61,3 @@ static const struct nf_nat_l4proto nf_nat_l4proto_sctp = {
 	.nlattr_to_range	= nf_nat_l4proto_nlattr_to_range,
 #endif
 };
-
-static int __init nf_nat_proto_sctp_init(void)
-{
-	int err;
-
-	err = nf_nat_l4proto_register(NFPROTO_IPV4, &nf_nat_l4proto_sctp);
-	if (err < 0)
-		goto err1;
-	err = nf_nat_l4proto_register(NFPROTO_IPV6, &nf_nat_l4proto_sctp);
-	if (err < 0)
-		goto err2;
-	return 0;
-
-err2:
-	nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_sctp);
-err1:
-	return err;
-}
-
-static void __exit nf_nat_proto_sctp_exit(void)
-{
-	nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_sctp);
-	nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_sctp);
-}
-
-module_init(nf_nat_proto_sctp_init);
-module_exit(nf_nat_proto_sctp_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("SCTP NAT protocol helper");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-- 
2.5.5


^ permalink raw reply related	[flat|nested] 8+ messages in thread

* [PATCH nf-next 3/3] netfilter: built-in NAT support for UDPlite
  2016-10-20 10:26 [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite Davide Caratti
  2016-10-20 10:26 ` [PATCH nf-next 1/3] netfilter: built-in NAT support for DCCP Davide Caratti
  2016-10-20 10:26 ` [PATCH nf-next 2/3] netfilter: built-in NAT support for SCTP Davide Caratti
@ 2016-10-20 10:26 ` Davide Caratti
  2016-10-20 10:28 ` [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite Florian Westphal
  3 siblings, 0 replies; 8+ messages in thread
From: Davide Caratti @ 2016-10-20 10:26 UTC (permalink / raw)
  To: Pablo Neira Ayuso, Patrick McHardy, Jozsef Kadlecsik,
	David S. Miller, Arturo Borrero Gonzalez, Florian Westphal
  Cc: netfilter-devel, coreteam

CONFIG_NF_NAT_PROTO_UDPLITE is no more a tristate. When set to y, NAT
support for UDPlite protocol is built-in into nf_nat.ko.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
---
 include/net/netfilter/nf_nat_l4proto.h |  3 +++
 net/netfilter/Kconfig                  |  2 +-
 net/netfilter/Makefile                 |  5 ++---
 net/netfilter/nf_nat_core.c            |  4 ++++
 net/netfilter/nf_nat_proto_udplite.c   | 35 +---------------------------------
 5 files changed, 11 insertions(+), 38 deletions(-)

diff --git a/include/net/netfilter/nf_nat_l4proto.h b/include/net/netfilter/nf_nat_l4proto.h
index d3d1670..83e234d 100644
--- a/include/net/netfilter/nf_nat_l4proto.h
+++ b/include/net/netfilter/nf_nat_l4proto.h
@@ -60,6 +60,9 @@ extern const struct nf_nat_l4proto nf_nat_l4proto_dccp;
 #if IS_ENABLED(CONFIG_NF_NAT_PROTO_SCTP)
 extern const struct nf_nat_l4proto nf_nat_l4proto_sctp;
 #endif
+#if IS_ENABLED(CONFIG_NF_NAT_PROTO_UDPLITE)
+extern const struct nf_nat_l4proto nf_nat_l4proto_udplite;
+#endif
 
 bool nf_nat_l4proto_in_range(const struct nf_conntrack_tuple *tuple,
 			     enum nf_nat_manip_type maniptype,
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 7fa6245..07de014 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -385,7 +385,7 @@ config NF_NAT_PROTO_DCCP
 	default NF_NAT && NF_CT_PROTO_DCCP
 
 config NF_NAT_PROTO_UDPLITE
-	tristate
+	bool
 	depends on NF_NAT && NF_CT_PROTO_UDPLITE
 	default NF_NAT && NF_CT_PROTO_UDPLITE
 
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 8605054..e1bcb9a 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -45,8 +45,10 @@ obj-$(CONFIG_NF_CONNTRACK_TFTP) += nf_conntrack_tftp.o
 nf_nat-y	:= nf_nat_core.o nf_nat_proto_unknown.o nf_nat_proto_common.o \
 		   nf_nat_proto_udp.o nf_nat_proto_tcp.o nf_nat_helper.o
 
+# NAT protocols (nf_nat)
 nf_nat-$(CONFIG_NF_NAT_PROTO_DCCP) += nf_nat_proto_dccp.o
 nf_nat-$(CONFIG_NF_NAT_PROTO_SCTP) += nf_nat_proto_sctp.o
+nf_nat-$(CONFIG_NF_NAT_PROTO_UDPLITE) += nf_nat_proto_udplite.o
 
 # generic transport layer logging
 obj-$(CONFIG_NF_LOG_COMMON) += nf_log_common.o
@@ -54,9 +56,6 @@ obj-$(CONFIG_NF_LOG_COMMON) += nf_log_common.o
 obj-$(CONFIG_NF_NAT) += nf_nat.o
 obj-$(CONFIG_NF_NAT_REDIRECT) += nf_nat_redirect.o
 
-# NAT protocols (nf_nat)
-obj-$(CONFIG_NF_NAT_PROTO_UDPLITE) += nf_nat_proto_udplite.o
-
 # NAT helpers
 obj-$(CONFIG_NF_NAT_AMANDA) += nf_nat_amanda.o
 obj-$(CONFIG_NF_NAT_FTP) += nf_nat_ftp.o
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index f5ee6b5..d677bb5 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -679,6 +679,10 @@ int nf_nat_l3proto_register(const struct nf_nat_l3proto *l3proto)
 	RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_SCTP],
 			 &nf_nat_l4proto_sctp);
 #endif
+#if IS_ENABLED(CONFIG_NF_NAT_PROTO_UDPLITE)
+	RCU_INIT_POINTER(nf_nat_l4protos[l3proto->l3proto][IPPROTO_UDPLITE],
+			 &nf_nat_l4proto_udplite);
+#endif
 	mutex_unlock(&nf_nat_proto_mutex);
 
 	RCU_INIT_POINTER(nf_nat_l3protos[l3proto->l3proto], l3proto);
diff --git a/net/netfilter/nf_nat_proto_udplite.c b/net/netfilter/nf_nat_proto_udplite.c
index 58340c9..366bfbf 100644
--- a/net/netfilter/nf_nat_proto_udplite.c
+++ b/net/netfilter/nf_nat_proto_udplite.c
@@ -8,11 +8,9 @@
  */
 
 #include <linux/types.h>
-#include <linux/init.h>
 #include <linux/udp.h>
 
 #include <linux/netfilter.h>
-#include <linux/module.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_l3proto.h>
 #include <net/netfilter/nf_nat_l4proto.h>
@@ -64,7 +62,7 @@ udplite_manip_pkt(struct sk_buff *skb,
 	return true;
 }
 
-static const struct nf_nat_l4proto nf_nat_l4proto_udplite = {
+const struct nf_nat_l4proto nf_nat_l4proto_udplite = {
 	.l4proto		= IPPROTO_UDPLITE,
 	.manip_pkt		= udplite_manip_pkt,
 	.in_range		= nf_nat_l4proto_in_range,
@@ -73,34 +71,3 @@ static const struct nf_nat_l4proto nf_nat_l4proto_udplite = {
 	.nlattr_to_range	= nf_nat_l4proto_nlattr_to_range,
 #endif
 };
-
-static int __init nf_nat_proto_udplite_init(void)
-{
-	int err;
-
-	err = nf_nat_l4proto_register(NFPROTO_IPV4, &nf_nat_l4proto_udplite);
-	if (err < 0)
-		goto err1;
-	err = nf_nat_l4proto_register(NFPROTO_IPV6, &nf_nat_l4proto_udplite);
-	if (err < 0)
-		goto err2;
-	return 0;
-
-err2:
-	nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_udplite);
-err1:
-	return err;
-}
-
-static void __exit nf_nat_proto_udplite_fini(void)
-{
-	nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_udplite);
-	nf_nat_l4proto_unregister(NFPROTO_IPV4, &nf_nat_l4proto_udplite);
-}
-
-module_init(nf_nat_proto_udplite_init);
-module_exit(nf_nat_proto_udplite_fini);
-
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("UDP-Lite NAT protocol helper");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-- 
2.5.5


^ permalink raw reply related	[flat|nested] 8+ messages in thread

* Re: [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite
  2016-10-20 10:26 [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite Davide Caratti
                   ` (2 preceding siblings ...)
  2016-10-20 10:26 ` [PATCH nf-next 3/3] netfilter: built-in NAT support for UDPlite Davide Caratti
@ 2016-10-20 10:28 ` Florian Westphal
  2016-10-20 10:36   ` Davide Caratti
  3 siblings, 1 reply; 8+ messages in thread
From: Florian Westphal @ 2016-10-20 10:28 UTC (permalink / raw)
  To: Davide Caratti
  Cc: Pablo Neira Ayuso, Patrick McHardy, Jozsef Kadlecsik,
	David S. Miller, Arturo Borrero Gonzalez, Florian Westphal,
	netfilter-devel, coreteam

Davide Caratti <dcaratti@redhat.com> wrote:
> The above L4 protocols usually need an explicit modprobe command (e.g
> "modprobe nf_nat_proto_sctp") to provide full functionality of REDIRECT
> targets and SNAT/DNAT targets where port number translation is explicitly
> configured.
> In order to remove such limitation, this series converts 
> CONFIG_NF_NAT_PROTO_{DCCP,SCTP,UDPLITE} from tristate to boolean: in case 
> NAT support for these protocols is enabled in the kernel configuration, it
> will be built into nf_nat.ko.

Sorry for not thinking of this sooner, but it would be nice to record
size increase of nat module in the commit message (and perhaps size of
'old' proto_foo nat module that is removed).

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite
  2016-10-20 10:28 ` [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite Florian Westphal
@ 2016-10-20 10:36   ` Davide Caratti
  0 siblings, 0 replies; 8+ messages in thread
From: Davide Caratti @ 2016-10-20 10:36 UTC (permalink / raw)
  To: Florian Westphal
  Cc: Pablo Neira Ayuso, Patrick McHardy, Jozsef Kadlecsik,
	David S. Miller, Arturo Borrero Gonzalez, netfilter-devel,
	coreteam

On Thu, 2016-10-20 at 12:28 +0200, Florian Westphal wrote:

> Sorry for not thinking of this sooner, but it would be nice to record
> size increase of nat module in the commit message (and perhaps size of
> 'old' proto_foo nat module that is removed).

hi,

yes - it makes sense. I will reword and post a v2 with test results.
regards,
--
davide

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2016-10-20 16:30 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-10-20 10:26 [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite Davide Caratti
2016-10-20 10:26 ` [PATCH nf-next 1/3] netfilter: built-in NAT support for DCCP Davide Caratti
2016-10-20 12:37   ` Pablo Neira Ayuso
2016-10-20 16:30     ` Davide Caratti
2016-10-20 10:26 ` [PATCH nf-next 2/3] netfilter: built-in NAT support for SCTP Davide Caratti
2016-10-20 10:26 ` [PATCH nf-next 3/3] netfilter: built-in NAT support for UDPlite Davide Caratti
2016-10-20 10:28 ` [PATCH nf-next 0/3] netfilter: built-in NAT support for DCCP, SCTP, UDPlite Florian Westphal
2016-10-20 10:36   ` Davide Caratti

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.